Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,307 vulnerabilities · newest first
- CVE-2026-86486Low 3.7In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blankPublished Sep 7, 2026
- CVE-2026-86485Low 3.5In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooksPublished Sep 7, 2026
- CVE-2026-86441Low 2.3Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information.Published Sep 7, 2026
- CVE-2026-86424Low 2.0ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps.Published Sep 7, 2026
- CVE-2026-86422Low 1.0ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions.Published Sep 7, 2026
- CVE-2026-86418Low 2.3Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view.Published Sep 7, 2026
- CVE-2025-52657Low 3.5HCL MyXalytics was affected by Potential DOS Vulnerability.Published Sep 7, 2026
- CVE-2025-52652Low 3.5HCL MyXalytics was affected by Content Spoofing Vulnerability.Published Sep 7, 2026
- CVE-2025-52651Low 3.5HCL MyXalytics was affected by Improper Input validation Vulnerability.Published Sep 7, 2026
- CVE-2026-86227Low 2.3A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1.Published Sep 6, 2026
- CVE-2026-84927Low 2.7The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries…Published Sep 5, 2026
- CVE-2026-84926Low 2.7The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site…Published Sep 5, 2026
- CVE-2026-84745Low 2.7The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents…Published Sep 5, 2026
- CVE-2026-84225Low 2.2The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to…Published Sep 5, 2026
- CVE-2026-81348Low 3.7The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site…Published Sep 5, 2026
- CVE-2026-78150Low 2.7The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a…Published Sep 5, 2026
- CVE-2025-15694Low 3.5The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site…Published Sep 5, 2026
- CVE-2025-15693Low 2.7The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and…Published Sep 5, 2026
- CVE-2026-86141Low 3.3xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.Published Sep 5, 2026
- CVE-2026-18540Low 3.7undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers.Published Sep 4, 2026
- CVE-2026-17483Low 3.3IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.Published Sep 4, 2026
- CVE-2026-84066Low 3.1The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing…Published Sep 4, 2026
- CVE-2026-45197Low 2.5Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory.Published Sep 4, 2026
- CVE-2026-82312Low 1.8OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objectsPublished Sep 4, 2026
- CVE-2026-81738Low 2.3OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entriesPublished Sep 4, 2026
- CVE-2026-85458Low 2.1Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.Published Sep 3, 2026
- CVE-2026-85052Low 3.1Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.Published Sep 3, 2026
- CVE-2026-84653Low 3.5Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify…Published Sep 2, 2026
- CVE-2026-63020Low 2.3A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messagesPublished Sep 2, 2026
- CVE-2026-78600Low 3.5Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122).Published Sep 2, 2026
- CVE-2026-78587Low 3.1Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122).Published Sep 2, 2026
- CVE-2026-19698Low 3.5The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject…Published Sep 2, 2026
- CVE-2026-14326Low 3.8The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other…Published Sep 2, 2026
- CVE-2025-15692Low 3.5The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored…Published Sep 2, 2026
- CVE-2023-3360Low 3.3The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present…Published Sep 2, 2026
- CVE-2026-81198Low 3.8The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum…Published Sep 2, 2026
- CVE-2026-81196Low 2.7The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct…Published Sep 2, 2026
- CVE-2026-77787Low 2.7The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role…Published Sep 2, 2026
- CVE-2026-77785Low 2.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role…Published Sep 2, 2026
- CVE-2026-77784Low 2.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on…Published Sep 2, 2026
- CVE-2026-77783Low 3.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft,…Published Sep 2, 2026
- CVE-2026-84359Low 3.1Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.Published Sep 2, 2026
- CVE-2026-84355Low 3.1Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Sep 2, 2026
- CVE-2026-84331Low 3.1Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Sep 2, 2026
- CVE-2026-84328Low 3.1Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Sep 2, 2026
- CVE-2026-84368Low 3.7From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where…Published Sep 1, 2026
- CVE-2026-84367Low 3.7From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a…Published Sep 1, 2026
- CVE-2026-84307Low 3.7From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating…Published Sep 1, 2026
- CVE-2026-73748Low 2.2A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format.Published Sep 1, 2026
- CVE-2026-73747Low 2.5A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer.Published Sep 1, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-86486 | In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank | Low 3.7 | |
| CVE-2026-86485 | In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks | Low 3.5 | |
| CVE-2026-86441 | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. | Low 2.3 | |
| CVE-2026-86424 | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. | Low 2.0 | |
| CVE-2026-86422 | ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. | Low 1.0 | |
| CVE-2026-86418 | Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. | Low 2.3 | |
| CVE-2025-52657 | HCL MyXalytics was affected by Potential DOS Vulnerability. | Low 3.5 | |
| CVE-2025-52652 | HCL MyXalytics was affected by Content Spoofing Vulnerability. | Low 3.5 | |
| CVE-2025-52651 | HCL MyXalytics was affected by Improper Input validation Vulnerability. | Low 3.5 | |
| CVE-2026-86227 | A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. | Low 2.3 | |
| CVE-2026-84927 | The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries… | Low 2.7 | |
| CVE-2026-84926 | The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site… | Low 2.7 | |
| CVE-2026-84745 | The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents… | Low 2.7 | |
| CVE-2026-84225 | The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to… | Low 2.2 | |
| CVE-2026-81348 | The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site… | Low 3.7 | |
| CVE-2026-78150 | The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a… | Low 2.7 | |
| CVE-2025-15694 | The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site… | Low 3.5 | |
| CVE-2025-15693 | The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and… | Low 2.7 | |
| CVE-2026-86141 | xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. | Low 3.3 | |
| CVE-2026-18540 | undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. | Low 3.7 | |
| CVE-2026-17483 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure. | Low 3.3 | |
| CVE-2026-84066 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing… | Low 3.1 | |
| CVE-2026-45197 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data outside the Guest's virtualised GPU memory. | Low 2.5 | |
| CVE-2026-82312 | OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects | Low 1.8 | |
| CVE-2026-81738 | OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries | Low 2.3 | |
| CVE-2026-85458 | Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height. | Low 2.1 | |
| CVE-2026-85052 | Out of bounds read in CrashReporting in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. | Low 3.1 | |
| CVE-2026-84653 | Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify… | Low 3.5 | |
| CVE-2026-63020 | A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages | Low 2.3 | |
| CVE-2026-78600 | Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). | Low 3.5 | |
| CVE-2026-78587 | Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). | Low 3.1 | |
| CVE-2026-19698 | The GutenKit WordPress plugin before 2.5.1 does not validate or escape style settings saved against a post before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject… | Low 3.5 | |
| CVE-2026-14326 | The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other… | Low 3.8 | |
| CVE-2025-15692 | The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored… | Low 3.5 | |
| CVE-2023-3360 | The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present… | Low 3.3 | |
| CVE-2026-81198 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum… | Low 3.8 | |
| CVE-2026-81196 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct… | Low 2.7 | |
| CVE-2026-77787 | The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role… | Low 2.7 | |
| CVE-2026-77785 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role… | Low 2.7 | |
| CVE-2026-77784 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on… | Low 2.7 | |
| CVE-2026-77783 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft,… | Low 3.7 | |
| CVE-2026-84359 | Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-84355 | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-84331 | Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-84328 | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-84368 | From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where… | Low 3.7 | |
| CVE-2026-84367 | From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a… | Low 3.7 | |
| CVE-2026-84307 | From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating… | Low 3.7 | |
| CVE-2026-73748 | A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. | Low 2.2 | |
| CVE-2026-73747 | A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. | Low 2.5 |
Showing 701–750 of 11,307. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.